Our SD tool auto assigns CIs to event records, because we always know which device is impacted. I am of the opinion that the CI for an incident or event should reflect the device that caused the service interruption, not necessarily what device was impacted.

One of my peers believes that for events, the CI should be left to reflect what device was impacted. Isnt that what the Service record is intended to reflect?

We use the Service record to reflect what service/business capability is impacted, and the CI to reflect a specific asset. My opinion is that you would want to choose the asset that caused impact to the service.

For example, you have 4 servers that go offline and an event record is generated. Through troubleshooting, you find that a switch actually caused the servers to go offline. Wouldn’t you want to select the CI for the switch?

If you choose the switch as the CI, you should be able to see if other incidents were caused by the switch outage, or if a change caused the switch to go offline. If you leave the server CIs on the event records, you would not be able to see related incidents, or perform change correlation/detection.

But John, I would think that ideally you would first decide on the level of information required, have the appropriate data model, etc, etc and then pick a tool that can support that. From the practical stand point, yes, he is probably limited by the existing tool implementation in his ability to select the appropriate CI.

Conceptually, I would tend to agree that you want the CI that caused the outage and not the one that first displayed the symptoms.